Do not open public issues for security-sensitive problems.

If you discover a vulnerability or accidental credential exposure, report it privately to the project maintainer first. Include:

• affected file or feature
• impact summary
• reproduction steps if applicable
• suggested mitigation if known

• Never commit .env
• Never commit exported documents from real workspaces
• Treat exposed APP_SECRET or equivalent credentials as compromised and rotate them immediately

This repository interacts with Feishu credentials and document exports. The highest-risk areas are:

• environment variable handling
• request authorization headers
• accidental storage of downloaded business documents
• logs that may reveal sensitive identifiers